How do I completely disable POP3 in WHM?

[Vatoloco]

I'm not using IMAP or POP3 because I've switched my e-mail to Google Apps.

In WHM, I've went to Main >> Service Configuration >> Mailserver Selection and set it to Disabled. POP3 still seems to be active though because I'm getting e-mail notices about failed login attempts on pop3d almost every day.

 

[cPanelTristan]

Is anything still running on port 110?

lsof -i :110
netstat -an|grep :110

You could firewall off the port (take it out of the firewall as an allowed port or block the port).

For my machine, even though I have pop3d, it isn't in WHM > Service Manager. Now, I do have IMAP there to uncheck for enabled and monitor, but I don't have pop. While an /etc/chkserv.d/pop file exists (chkservd handles Service Manager restarts for a service), pop is not in the chkservd configuration file at /etc/chkserv.d/chkservd.conf location as a listed service.

If anything is running on port 110, then the service is still running. If nothing is running on port 110, then simply block the port in the firewall.

By the way, exactly how are you getting alerts for login attempts? What service is sending these - cPHulk Brute Force Protection or CSF / LFD or something else?

 

[Vatoloco]

[email protected] [~]# lsof -i :110
COMMAND    PID USER   FD   TYPE DEVICE SIZE NODE NAME
couriertc 3763 root    3u  IPv4  10174       TCP *:pop3 (LISTEN)

I also only have IMAP listed in the Service Manager and I've disabled it.

CSF/LFD is what's letting me know about all the failed login attempts on pop3.

I searched around and one suggestion to disable pop3 was to run /scripts/setupmailserver but it's already showing as disabled for me.

[email protected] [~]# /scripts/setupmailserver --current
Current mailserver type: disabled
Current storage format: maildir

 

[Vatoloco]

Okay, I think I finally got it turned off. I ran:

/scripts/setupmailserver --force disabled​

And now "lsof -i :110" is returning nothing.

 

[cPanelTristan]

Great to hear. If that doesn't work, then you are using CSF and LFD, there's no point to have port 110 opened. You could remove it in WHM > Plugins > ConfigServer Security & Firewall area in the firewall configuration file.